oss/Radicale
oss/Radicale
1
0
Fork 0
mirror of https://github.com/Kozea/Radicale.git synced 2025-09-15 20:36:55 +00:00
Code Wiki Activity

Fix permissions for REPORT request

Browse source 
Only read access is required.
This commit is contained in:
Unrud 2017-03-13 08:22:14 +01:00 • committed by GitHub
parent c1f0e66232
commit 8a98f4861d
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
radicale/__init__.py
View file

@ -677,12 +677,12 @@ class Application:
def do_REPORT(self, environ, base_prefix, path, user): def do_REPORT(self, environ, base_prefix, path, user):
"""Manage REPORT request.""" """Manage REPORT request."""
if not self._access(user, path, "w"): if not self._access(user, path, "r"):
return NOT_ALLOWED return NOT_ALLOWED
content = self._read_content(environ) content = self._read_content(environ)
with self.Collection.acquire_lock("r", user): with self.Collection.acquire_lock("r", user):
item = next(self.Collection.discover(path), None) item = next(self.Collection.discover(path), None)
if not self._access(user, path, "w", item): if not self._access(user, path, "r", item):
return NOT_ALLOWED return NOT_ALLOWED
if not item: if not item:
return NOT_FOUND return NOT_FOUND